import { StringCatalog } from "../catalog";

const strings: StringCatalog = {
	heading: "This was a phishing simulation",
	intro: "The good news: it wasn't a real attack. Take a minute to see the warning signs you missed — it could save you next time.",
	next: "Next",
	back: "Back",
	skip: "Skip tutorial",
	continue: "Continue",
	progress: "Step {n} of {total}",
	arrow_hint: "The web address is up here",
	step_url_title: "Always check the address first",
	step_url_body: "Look at the address bar at the top of your browser. This page's address doesn't belong to the real organization — attackers count on you not looking.",
	url_actual_label: "The address you were on",
	url_reason_ip: "This address is a raw IP address instead of a company name. Real organizations use their own domain, so a numeric address is a strong sign of a fake site.",
	url_reason_punycode: "This address uses special characters that imitate ordinary letters. Attackers use them so a fake domain looks identical to a real one at a glance.",
	url_reason_brand_subdomain: "Read the address from the right, not the left. The part that decides where you are is {domain}; everything before it is a subdomain, and whoever owns {domain} can create as many as they like, named anything they like.",
	url_reason_brand_in_subdomain: "The address really does contain {brand} — but only as a subdomain. Real sites use subdomains too, which is exactly why they prove nothing: whoever owns {domain} can put any name in front of it. What decides where you are is {domain}, the part immediately before the first slash.",
	url_reason_hyphen: "The real domain here is {domain}. Attackers glue brand names together with hyphens to look official; the genuine site would simply use the brand's own domain.",
	url_reason_tld: "The real domain here is {domain}. Its ending (.{tld}) is rarely used by established organizations and is popular with attackers because it's cheap to register.",
	url_reason_long: "Look at how long and cluttered this address is: a chain of extra words, dashes and random characters around {domain}. Genuine sign-in pages live on a short, plain domain — length and clutter are there to push the real name out of sight.",
	url_reason_generic: "The part that decides where you really are is {domain} — the text right before the first slash. Everything else in the address can be made to look convincing.",
	step_password_title: "This form wanted your password",
	step_password_body: "You were one step away from handing your password to an attacker. Real organizations never ask you to confirm your password through a link in an email. When in doubt, open the site yourself by typing its address.",
	step_cc_title: "This form asked for card details",
	step_cc_body: "Entering your card number, expiry date, and security code here would have sent them straight to criminals. Legitimate companies don't collect payment details through unexpected links.",
	step_download_title: "This download could have been malware",
	step_download_body: "This file could have installed malicious software on your device. Check the file extension before opening anything — and only download software from sources you trust.",
	step_suspicious_link_title: "This link isn't what it claims",
	step_suspicious_link_body: "The link's text says {shown}, but it actually leads to {actual}. Hover over links to preview the real destination before clicking.",
	step_brand_title: "This page pretends to be {brand}",
	step_brand_body: "It presents itself as {brand}, but the address belongs to {domain}. Big companies don't put their sign-in pages on unrelated domains — a name on the page that doesn't match the name in the address bar is one of the clearest signs of a fake.",
	step_urgency_title: "Urgency is a pressure tactic",
	step_urgency_body: "\"Act now\", deadlines, threats of suspended accounts — attackers create pressure so you act before you think. Real companies rarely demand immediate action; slow down when a message rushes you.",
	urgency_quote: "This page pressured you with: \"{quote}\"",
	perm_mic_title: "You gave away your microphone",
	perm_mic_body: "This page can now listen through your microphone until you revoke access. A real site tells you why it needs your mic — for a call or a recording you started yourself.",
	perm_webcam_title: "You gave away your camera",
	perm_webcam_body: "This page can now see through your camera until you revoke access. Only allow camera access on a site you opened yourself, where a video call is clearly expected.",
	perm_location_title: "You shared your location",
	perm_location_body: "This page now knows where you are. Legitimate sites ask for your location only when it's obviously needed, like finding a nearby store — and they still work if you decline.",
	perm_notification_title: "You allowed notifications",
	perm_notification_body: "This page can now push messages to your desktop, even after you close it. Attackers use them to deliver fake virus alerts and lure you into further scams.",
	perm_clipboard_title: "You gave access to your clipboard",
	perm_clipboard_body: "Your clipboard often holds a password, card number, or crypto address you just copied. A page with clipboard access can read it — or silently swap what you paste.",
	perm_extension_title: "You installed a browser extension",
	perm_extension_body: "Extensions can read and change every page you visit, including your email and your bank. Install them only from official stores, and only when you know who publishes them.",
	perm_command_title: "You copied a command a web page told you to run",
	perm_command_body: "No real CAPTCHA, update or fix asks you to press Win+R, open a terminal or paste a command. Running what this page put on your clipboard would have let an attacker install malware on your computer.",
	perm_consent_title: "You gave an unknown app access to your account",
	perm_consent_body: "Accepting this screen lets the app read your email or files without ever knowing your password — changing your password doesn't stop it. Check who publishes an app and what it asks for, and decline any request you didn't start yourself.",
	lesson_login_title: "The padlock doesn't mean it's safe",
	lesson_login_body: "A padlock icon or \"https\" only means your connection is encrypted — not that the site is genuine. Phishing sites use encryption too. Trust the domain name, not the padlock.",
	lesson_fraud_title: "How to protect your money",
	lesson_fraud_body: "Never enter payment details on a page you reached from an email or message. Go to the company's official website or app yourself, or call the number on the back of your card.",
	lesson_malware_title: "Verify before you download",
	lesson_malware_body: "Attachments and downloads are a favorite way to sneak malware onto your device. Confirm with the sender through another channel, and be suspicious of file types like .exe, .zip, or documents asking you to enable macros.",
	lesson_fake_title: "If it looks too good to be true…",
	lesson_fake_body: "Fake pages imitate trusted brands to get your click, your data, or your trust. Check the address, look for sloppy details, and when something feels off, close the page and navigate there yourself.",
	lesson_permission_title: "Be careful what you allow",
	lesson_permission_body: "You just granted this page access it shouldn't have. Legitimate sites explain why they need your camera, microphone, or location before asking. Only grant permissions you fully understand — you can review them in your browser settings.",
	step_done_title: "What to check next time",
	step_done_body: "Check the address, question urgency, guard your passwords and card details, and think before you download. Click Continue to move on.",
};

export default strings;